1. Data controller
JTU VENTURES LTD (company number 17142431, 20 Arnold Court, Northwich, CW8 4UB, United Kingdom) is the data controller for personal data processed through The Wellness Hub by JTU. For any privacy question, data request or complaint, email hello@jtuventures.co.uk.
We are registered with the Information Commissioner's Office. Registration reference: ZC213779.
2. What we collect
Mood, journal, habit and Circle data are special category health data under UK GDPR. We only process them because you give explicit consent at signup, and you can withdraw that consent at any time by deleting your account.
3. What we never do
- We do not sell your data, ever.
- We do not use advertising networks or third-party behavioural tracking in the app.
- We do not show your real name or email address to other members.
- We do not read your journal entries for marketing or profiling.
4. Who processes data for us
We use a small number of carefully chosen suppliers who process data on our instructions under written terms:
- Supabase — database, authentication and encrypted file storage for photos and voice notes.
- Lovable — application hosting and delivery.
- Resend — sending account emails such as confirmations, password resets and event notices.
- Web push services operated by Apple, Google and Mozilla — delivering notifications to your device.
- An AI provider used to generate your private weekly reflection. Content sent for this purpose is not used to train third-party models.
Some of these suppliers may process data outside the UK. Where that happens we rely on the UK International Data Transfer Addendum or an adequacy decision to keep your data protected to UK standards.
5. How long we keep it
- Account and wellbeing data: for as long as your account is open, then deleted within 30 days of a deletion request.
- Sharing Circle posts: kept while your account is open; after deletion they may remain in anonymised form so conversations stay readable.
- Event bookings: up to 24 months after the event, for attendance records.
- Email delivery logs: up to 12 months.
- Security and error logs: up to 12 months.
6. Security
- All traffic is encrypted in transit with HTTPS, and data is encrypted at rest by our hosting provider.
- Row-level security rules in the database mean one member's records cannot be read by another.
- Photos and voice notes are held in private storage and served only through short-lived signed links to their owner.
- Passwords are hashed and never visible to us. Email addresses must be confirmed before an account becomes active.
- Administrative access is limited to named individuals who need it.
7. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased.
- Restrict or object to how we use it.
- Receive your data in a portable format.
- Withdraw consent at any time, without affecting anything done before you withdrew it.
Email hello@jtuventures.co.uk to exercise any of these. We will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Data breaches
If a breach happens that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and tell affected members directly where the risk is high.
9. Changes
We will update this policy as the app changes and will ask you to review any material change in the app itself.